import type { languages } from 'monaco-editor'; export function buildMonarchLanguage(): languages.IMonarchLanguage { return { defaultToken: '', tokenPostfix: '.kql', brackets: [ { open: '{', close: '}', token: 'delimiter.curly' }, { open: '(', close: ')', token: 'delimiter.parenthesis' }, ], tokenizer: { root: [ // Whitespace [/[ \t\r\n\u00A0]+/, 'white'], // Quoted strings [/"/, { token: 'string.quote', next: '@string' }], // Operators (longer patterns first) [/<=/, 'operator'], [/>=/, 'operator'], [/[<>:]/, 'operator'], // Brackets [/[{}]/, 'delimiter.curly'], [/[()]/, 'delimiter.parenthesis'], // Literals [/\b(?:null|true|false)\b/, 'keyword.literal'], // Conjunction keywords (all case combinations — Monarch ignores rule-level /i): // and/or must be followed by whitespace, not too. [/[aA][nN][dD](?=[ \t\r\n\u00A0]|$)/, 'keyword'], [/[oO][rR](?=[ \t\r\n\u00A0]|$)/, 'keyword'], [/[nN][oO][tT](?=[ \t\r\n\u00A0]|$)/, 'keyword'], // Numbers [/\d+(?:\.\d+)?/, 'number'], // Escaped characters (e.g. \: \( \and \uXXXX) [/\\./, 'identifier'], // Wildcard [/\*/, 'operator.wildcard'], // Unquoted literal run (field names like machine.os, bare values) [/[^\s\\():<>"*{}]+/, 'identifier'], ], string: [ [/[^\\"]+/, 'string'], [/\\(?:u[0-9a-fA-F]{4}|[\s\S])/, 'string.escape'], [/"/, { token: 'string.quote', next: '@pop' }], ], }, } as languages.IMonarchLanguage; }